rule APT_APT27_Enc_Hyperbro_Apr_2021_1 {
   meta:
        description = "Detect encoded hyperbro payload"
        author = "Arkbird_SOLG"
        reference = "-"
        date = "2021-05-01"
        hash1 = "5a98c49b4e5d980bc8078cbbd8899397e95a488234a87a12813fe437c585600f"
        hash2 = "601a02b81e3bd134c2cf681ac03d696b446e10bf267b11b91517db1b233fec74"
        hash3 = "80fc8917c91c132e5274319013a4b659e435e8de8abf655cf3482798acb8650a"
        hash4 = "83406f39147b01136bf9b3b88a1ec1a9339cd9d0cbcfa2a2583e3f97ad852287"
        tlp = "Green"
        level = "Experimental"
        adversary = "APT27"
   strings:
        $seq1 = { e? 6? 0? 0? 0? c? 5? 8? ?? 5? 5? 8? 6? f? 0? 8? 4? 0? 8? 4? ?? 8? 4? [2] b? 0? 8? c? 7? 2? 8? 4? [2] b? 0? 8? c? 6? 0? 4? f? 8? 4? f? 8? 4? f? d? e? 8? 4? f? ?? b? 4? ?? 3? c? 8? c? ?? 9? c? 4? 0? [2] 8? [2] e? c? 8? 4? f? c? c? 5? 8? ?? 8? ?? 3? 6? a? 3? 0? 0? 0? 8? 4? f? 8? 4? f? 8? 4? ?? 8? 4? ?? 8? 4? ?? 8? 4? ?? 8? 4? f? 8? 4? f? 8? 7? 1? 0? ?? 8? c? 0? 0? 0? 6? 0? 8? 4? f? ?? 7? 3? e? [3] ?? 5? 5? 3? 4? 0? ?? 8? a? 0? 0? 0? 8? 4? f? 8? 4? 1? 8? 4? e? 8? 4? e? 8? ?? e? 0? 4? ?? 8? [2] 8? 4? ?? 8? 4? 7? 8? 4? f? 8? 4? e? 0? 4? f? 8? 4? e? 8? 4? e? 8? 4? 1? 8? 4? e? 8? 4? e? 8? ?? e? 0? 4? 2? 8? [2] 8? 6? d? 0? e? 0? 8? 4? d? 4? 8? 4? d? 8? 4? d? 3? 4? e? 7? 5? 8? 4? ?? 8? 0? 0? 4? e? 8? 4? d? 6? 0? ?? 7? d? e? 0? [3] 5? 5? 3? 4? ?? 7? 2? 8? 4? e? 8? ?? e? 0? 4? 2? 8? 4? d? 6? 8? 0? 4? 6? 8? 4? d? 8? 4? e? 8? ?? e? 0? 4? [2] b? 4? d? 8? 5? e? 0? 1? 8? 8? c? e? 1? 8? 4? ?? 8? c? 0? 8? 4? ?? e? ?? 8? 4? f? 8? 0? 8? 4? f? e? 2? [3] 3? c? c? c? 5? 8? ?? 8? [2] 0? 7? 1? ?? 7? 1? 6? 0? 8? 4? 0? ?? 5? ?? 5? 8? 4? 0? ?? 5? 1? e? 1? e? 1? ?? 7? 1? ?? 7? ?? 6? 0? 8? 4? 0? ?? 5? ?? 5? 8? 4? 0? ?? 5? 1? ?? c? 5? 8? ?? 8? ?? 1? 8? 4? 1? 8? 4? 0? 8? 4? f? 8? 4? 1? 8? 0? 8? ?? 1? 8? 0? ?? b? 4? 1? ?? 4? 0? 1? 8? 4? ?? 8? 6? ?? 0? e? 1? 8? 4? ?? 4? 8? 4? ?? 8? 4? ?? 8? c? 2? 8? 4? ?? 8? 4? 1? 8? 0? ?? b? 4? 0? 3? 4? [3] 9? 0? 0? 0? 8? 4? ?? 8? 7? 1? 0? 7? 4? 8? 4? 1? 8? 4? 3? 8? 4? f? 8? ?? f? 0? ?? 3? 6? 0? 6? 0? 1? 0? 0? ?? 7? f? 8? 4? ?? 8? ?? f? 0? 4? ?? 5? 8? 4? 0? ?? 5? 2? 8? 4? f? 8? 4? ?? 8? ?? f? 8? 4? 0? ?? 7? f? 6? 0? ?? 7? f? 8? 4? 0? ?? 5? 1? 8? c? ?? e? ?? 6? 0? 6? 0? 1? 0? }
        $seq2 = { 0? 0? 4? e? 8? 4? d? 6? 0? ?? 7? d? e? 0? [3] 5? 5? 3? 4? ?? 7? 2? 8? 4? e? 8? ?? e? 0? 4? 2? 8? 4? d? 6? 8? 0? 4? 6? 8? 4? d? 8? 4? e? 8? ?? e? 0? 4? [2] b? 4? d? 8? 5? e? 0? 1? 8? 8? c? e? 1? 8? 4? ?? 8? c? 0? 8? 4? ?? e? ?? 8? 4? f? 8? 0? 8? 4? f? e? 2? [3] 3? c? c? c? 5? 8? ?? 8? [2] 0? 7? 1? ?? 7? 1? 6? 0? 8? 4? 0? ?? 5? ?? 5? 8? 4? 0? ?? 5? 1? e? 1? e? 1? ?? 7? 1? ?? 7? ?? 6? 0? 8? 4? 0? ?? 5? ?? 5? 8? 4? 0? ?? 5? 1? ?? c? 5? 8? ?? 8? ?? 1? 8? 4? 1? 8? 4? 0? 8? 4? f? 8? 4? 1? 8? 0? 8? ?? 1? 8? 0? ?? b? 4? 1? ?? 4? }
        $seq3 = { f? 0? 4? ?? 5? 8? 4? 0? ?? 5? 2? 8? 4? f? 8? 4? [2] 7? 1? 8? 4? ?? 8? [2] 0? 4? 1? 5? ?? 7? f? 8? 4? 0? ?? 5? ?? 8? c? ?? 8? 4? ?? 8? ?? f? 8? 4? 0? e? 4? [3] c? c? 5? 8? ?? 8? ?? 4? 8? 4? ?? 8? 0? 8? [2] 8? 0? ?? b? 4? 1? ?? 4? 0? 1? 8? 4? d? c? 4? ?? 0? 0? 0? 0? c? 4? e? 0? 0? 0? 0? c? 4? e? 0? 0? 0? 0? c? 4? e? 0? 0? 0? 0? c? 4? ?? 1? 0? 0? 0? c? 4? f? 8? 0? 0? 0? c? 4? f? 2? 0? 0? 0? c? 4? f? 4? 0? 0? 0? 8? 6? ?? 0? e? 1? 8? 4? ?? 4? 8? 4? ?? 8? 4? d? 8? c? 2? 8? 4? d? 8? 4? ?? 8? 0? ?? b? 4? 0? 3? 4? [3] f? 0? 0? 0? 8? 4? d? 8? 4? 2? 2? 0? 0? 0? 2? f? d? 1? c? f? d? 8? 4? ?? 8? 4? d? 8? 4? 2? 2? 0? 0? 0? 4? f? d? 1? c? f? d? 8? 4? c? 8? 4? d? 8? 4? 2? 2? 0? 0? 0? 8? f? d? 1? c? f? d? 8? 4? d? 8? 4? d? 8? 4? 2? 2? 0? 0? 0? 0? }
        $seq4 = { c? 0? 7? 3? 8? 4? d? 8? 4? 2? 8? e? 4? 7? ?? 8? 4? ?? 8? 0? 8? 4? 2? 8? 4? c? e? 1? 8? 4? d? 8? 4? 2? 2? 8? 0? 0? 0? 7? 0? 8? 4? ?? 8? 0? 8? 4? 2? 8? 4? c? 8? ?? c? 0? 7? 1? ?? 4? d? 5? ?? 7? c? 8? 4? d? ?? 7? 1? 8? 4? d? ?? 7? 0? 8? 4? 0? ?? 5? ?? e? e? [3] c? c? 5? 8? ?? 8? ?? 2? 8? 4? 0? 8? 4? 0? 8? 4? f? 8? 4? 0? 8? 0? 0? a? 0? 0? 0? 8? 4? f? 8? 4? f? 8? 7? 0? 0? ?? 8? a? 0? 0? 0? 8? 4? f? 8? ?? f? 0? 0? 8? ?? f? 8? 4? f? 8? 3? 0? ?? 8? ?? 0? 0? 0? 8? 4? f? 8? ?? f? 0? 0? 8? [2] 8? 4? f? 8? c? 0? 8? 4? e? 8? 6? ?? 0? e? ?? 8? 4? ?? 4? 8? 4? ?? 8? 4? e? 4? 4? 8? 4? e? 8? 4? f? 8? 4? 0? 8? e? 0? d? e? 3? 4? ?? 7? 4? 8? 4? e? ?? b? 0? c? f? ?? 8? 4? e? 8? 4? e? ?? b? 0? 2? [2] 0? 0? 8? 4? e? 8? 4? e? 8? 4? d? 8? ?? d? 0? 7? 0? e? 1? e? 1? 8? 4? ?? 0? 4? e? 8? 4? ?? 8? 4? ?? 8? 0? 0? 4? ?? 8? [2] 8? 0? e? ?? 8? 4? f? 8? ?? f? 0? 4? 0? 8? ?? f? e? 6? [3] c? c? 5? 8? ?? 8? ?? 2? c? 4? f? 0? 0? 0? 0? 8? 4? ?? 8? 4? 0? 8? 4? f? 8? 4? ?? 8? 0? 0? 8? 0? 0? 0? 8? 4? ?? 8? 4? ?? 8? 7? 0? 0? ?? 8? 6? 0? 0? 0? 8? 4? ?? 8? ?? f? 0? 0? 8? ?? f? e? 0? 8? 4? f? 8? c? 1? 8? 4? f? 6? 1? ?? 7? f? 8? 4? 0? ?? 5? 2? 8? c? ?? 8? ?? 0? 0? 0? 8? 4? f? 8? 7? ?? 0? ?? 8? ?? 0? 0? 0? 8? 4? f? 8? ?? f? 0? 4? ?? 5? 8? 4? 0? ?? 1? 8? 4? e? 8? ?? e? ?? 7? 0? 8? 6? f? 0? e? ?? 0? 0? 0? 8? }
   condition:
     filesize > 10KB and all of them
}
